mod_pagespeed-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("https://dl-ssl.google.com/dl/linux/direct/mod-pagespeed-stable_current_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source URL points to Google's official dl-ssl.google.com distribution host, which is a legitimate vendor CDN. However, the URL uses 'current' (a moving/redirect alias) rather than a pinned version-specific filename, meaning the downloaded .deb content can change over time while the sha256sum in the PKGBUILD remains fixed at the old value — or conversely, the checksum could become stale and break the build. More importantly, this is a prebuilt binary Apache module (.so) extracted from a Debian package and installed directly into the system's Apache/httpd module directory. Prebuilt binary blobs executed/loaded by a privileged service (Apache) represent a genuine supply-chain concern: the binary is not built from source, cannot be audited, and the 'current' alias means the actual binary fetched may not match what was originally checksummed. The host is legitimate but the moving-target URL combined with a prebuilt privileged binary warrants a medium rating.